Subject: [keyassure] two vs multi

From: [email-masked]
Date: Fri, 27 Aug 2010 17:34:18 +0000

One presumes that (a) validating the DNS delegation chain, and then finding at 
the end of that validation, (b) a crypto-bundle of goodness is the functional
equivalent of what is known as "two-factor" authentication.

So if One validates (a) the forward delegation chain, (b) the reverse delegation 
chain, and finds (c) the _same_ crypto-bundle of goodness at the end of each
validation chain, would this be the functional equivalent of "Multi-factor"
authentication?

--bill

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 27 Aug 2010 20:15:40 +0200

> equivalent of what is known as "two-factor" authentication.

I'm confused.  Unless I'm misunderstanding you, I wouldn't call what you
describe two-factor authentication at all.  To me, two-factor
authentication is about client authentication, and each factor has to be
an independent authentication that is provided by the client.  See:
http://en.wikipedia.org/wiki/Two-factor_authentication

/Simon

---

From: [email-masked]
Date: Fri, 27 Aug 2010 18:28:18 +0000

> http://en.wikipedia.org/wiki/Two-factor_authentication

	perhaps i misunderstand.  the DNSSEC validation chain as a factor
	consists of a series of independent folks vouching for each other.

	the second factor is the CERT at the end of the chain, in my understanding
	of the CERT RR, this is effectively an x509 CERT, which is provided by
	a CA*  Thats two distinct, independent sources... neither of which is
	the client.  Right?

* - presuming the same party signing a zone is not also your friendly CA... :)

--bill

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 27 Aug 2010 11:30:13 -0700

>* - presuming the same party signing a zone is not also your friendly CA... :)

I'm with Simon: your description has nothing to do with what is commonly called two-factor authentication.

--Paul Hoffman, Director
--VPN Consortium

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 27 Aug 2010 14:37:25 -0400

I would try to keep clear of the term two factor for anything other
than end user authentication and then where the authentication factors
are based on different principles (e.g. something known, something
carried).

The term has been widely abused of late due to the interpretation of
the federal reserve regulations requiring 'two factor' that allow for
non-two factor schemes.

This is machine-machine authentication and only one factor is possible.

We could use the phrase multiple trust chain or similar.

On Fri, Aug 27, 2010 at 2:30 PM, Paul Hoffman <[email-masked]> wrote:
> _______________________________________________
> keyassure mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyassure
>

-- 
Website: http://hallambaker.com/

---

From: Stephen Kent <[email-masked]>
Date: Fri, 27 Aug 2010 17:54:04 -0400

>validation chain, would this be the functional equivalent of "Multi-factor"

not based on the common uses of this term. Usually multi-factor 
implies use of different technologies to authenticate (a person), not 
multiple uses of the same technology managed by different entities.

Steve